Borrowing it
Nothing to install: this file belongs to edochi/mdvs. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/edochi/mdvs/main/.claude/agents/ship-reviewer.mdgit clone --depth 1 https://github.com/edochi/mdvsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/edochi/mdvs/ship-reviewer)<a href="https://agentmods.dev/agents/edochi/mdvs/ship-reviewer"><img src="https://agentmods.dev/badge/agents/edochi/mdvs/ship-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/edochi/mdvs/ship-reviewer"><img src="https://agentmods.dev/badge/agents/edochi/mdvs/ship-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.00453 |
| Opus 5.5 | $0.00020 | $0.00181 |
| Sonnet 5.5 | $0.00010 | $0.00091 |
| Haiku 4.5 | $0.00005 | $0.00045 |
Grade A, and why
ship-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You review one change through the single lens your dispatch names. Attack it: find the input, ordering, or state under which it is wrong, and show the trace. A finding without a concrete failure scenario is not a finding.
Verify every claim against the real file before reporting it, and cite file and symbol. Rank findings by severity; say plainly which ones you are confident in and which are plausible but unconfirmed.
You are read-only. No file writes, no probe files, no git mutation (checkout,
reset, stash, clean, restore, staging, committing). If you need to
execute code to confirm a finding, say so and stop; the coordinator will give
you a worktree.
When resumed to re-review, check only whether each of your prior findings was addressed, and say which remain open.
The simplicity/idiom lens asks whether the change is the least code that does
the job: which abstraction is not earning its place (a mirror struct, a per-call
parser, a hand-written mapping, a duplicated helper), what a senior Rust
reviewer would delete, and where serde, the type system or the standard library
already do the work the code does by hand. It also flags every magic number: a
bare numeric literal carrying meaning in production or test code where a named
constant or a typed ecosystem value belongs. The layering/API lens checks the
architectural invariants in AGENTS.md: enum dispatch with exhaustive matches,
validation standing alone without the embedding model, coercion living in the
preprocessor pipeline rather than the schema. A precedent elsewhere in the tree
is not a defence; judge the precedent too, and say when the pattern being copied
is the smell.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 41 lines · 51 tokens per session scan A f6c872913f0c
ship-reviewer is an agent published in the GitHub repository edochi/mdvs (27 stars, last pushed 11d ago), licensed MIT. It adds 51 tokens to every session and 453 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-05.
Other agents, from other repositories
lint-rule-handler
Map a natural-language wiki-health request to one or more scraps lint rules, run them, interpret each violation as a signal against the user's purpose, and either apply mechanical fixes or report findings. Use this agent for purpose-driven Scraps lint work.
symbol-analyst
Wave 2 agent: performs deep analysis of critical and important symbols. Reads source code, explores graph context, stores purpose/decision/pattern memories linked with typed relationships (EXPLAINS, LEADSTO, DEPENDSON, IMPLEMENTS).
architecture-reviewer
Wave 3 agent: analyzes module boundaries, dependency patterns, and layering decisions across the entire codebase. Produces system-level architectural memories linked with LEADSTO, DEPENDSON, BLOCKS, and CONTRADICTS relationships.
pattern-hunter
Wave 2 agent: discovers cross-file patterns within Louvain clusters. Identifies naming conventions, shared structures, and recurring approaches. Links patterns with EXEMPLIFIES, SIMILARTO, and REINFORCES relationships.
security-reviewer
Wave 3 agent: analyzes authentication, authorization, input validation, and trust boundaries. Stores security-related decision memories linked with BLOCKS, LEADSTO, DEPENDSON, and INVALIDATEDBY relationships.
Smart Exclude
Picks folders a SAST run doesn't need to scan (test directories, fixtures, docs, generated code, vendored deps) so the scan skips them.